Docker Hardened Images are now FREE for every developer. Read blog.
✕

## wazuh/wazuh-manager

By wazuh

•Updated 2 days ago

XDR + SIEM

Image
29

1M+

Overview Tags

# wazuh/wazuh-manager repository overview

###
Wazuh containers for Docker

In this repository you will find the containers to run:

- Wazuh manager: it runs the Wazuh manager, Wazuh API and Filebeat OSS
- Wazuh dashboard: provides a web user interface to browse through alerts data and allows you to visualize agents configuration and status.
- Wazuh indexer: Wazuh indexer container (working as a single-node cluster or as a multi-node cluster). Be aware to increase the `vm.max_map_count` setting, as it's detailed in the Wazuh documentation⁠
  .

The folder `build-docker-images` contains a README explaining how to build the Wazuh images and the necessary assets. The folder `indexer-certs-creator` contains a README explaining how to create the certificates creator tool and the necessary assets. The folder `single-node` contains a README explaining how to run a Wazuh environment with one Wazuh manager, one Wazuh indexer, and one Wazuh dashboard. The folder `multi-node` contains a README explaining how to run a Wazuh environment with two Wazuh managers, three Wazuh indexer, and one Wazuh dashboard.

####
Documentation

- Wazuh full documentation⁠
- Wazuh documentation for Docker⁠
- Docker hub

#####
Setup SSL certificate

Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed).

Documentation on how to provide these two can be found at Wazuh Docker Documentation⁠
.

####
Environment Variables

Default values are included when available.

#####
Wazuh

    API_USERNAME="wazuh-wui"                            # Wazuh API username
    API_PASSWORD="MyS3cr37P450r.*-"                     # Wazuh API password - Must comply with requirements
                                                        # (8+ length, uppercase, lowercase, specials chars)

    INDEXER_URL=https://wazuh.indexer:9200              # Wazuh indexer URL
    INDEXER_USERNAME=admin                              # Wazuh indexer Username
    INDEXER_PASSWORD=SecretPassword                     # Wazuh indexer Password
    FILEBEAT_SSL_VERIFICATION_MODE=full                 # Filebeat SSL Verification mode (full or none)
    SSL_CERTIFICATE_AUTHORITIES=""                      # Path of Filebeat SSL CA
    SSL_CERTIFICATE=""                                  # Path of Filebeat SSL Certificate
    SSL_KEY=""                                          # Path of Filebeat SSL Key

#####
Dashboard

    PATTERN="wazuh-alerts-*"        # Default index pattern to use

    CHECKS_PATTERN=true             # Defines which checks must to be consider by the healthcheck
    CHECKS_TEMPLATE=true            # step once the Wazuh app starts. Values must to be true or false
    CHECKS_API=true
    CHECKS_SETUP=true

    EXTENSIONS_PCI=true             # Enable PCI Extension
    EXTENSIONS_GDPR=true            # Enable GDPR Extension
    EXTENSIONS_HIPAA=true           # Enable HIPAA Extension
    EXTENSIONS_NIST=true            # Enable NIST Extension
    EXTENSIONS_TSC=true             # Enable TSC Extension
    EXTENSIONS_AUDIT=true           # Enable Audit Extension
    EXTENSIONS_OSCAP=false          # Enable OpenSCAP Extension
    EXTENSIONS_CISCAT=false         # Enable CISCAT Extension
    EXTENSIONS_AWS=false            # Enable AWS Extension
    EXTENSIONS_GCP=false            # Enable GCP Extension
    EXTENSIONS_VIRUSTOTAL=false     # Enable Virustotal Extension
    EXTENSIONS_OSQUERY=false        # Enable OSQuery Extension
    EXTENSIONS_DOCKER=false         # Enable Docker Extension

    APP_TIMEOUT=20000               # Defines maximum timeout to be used on the Wazuh app requests

    API_SELECTOR=true               Defines if the user is allowed to change the selected API directly from the Wazuh app top menu
    IP_SELECTOR=true                # Defines if the user is allowed to change the selected index pattern directly from the Wazuh app top menu
    IP_IGNORE="[]"                  # List of index patterns to be ignored

    DASHBOARD_USERNAME=kibanaserver     # Custom user saved in the dashboard keystore
    DASHBOARD_PASSWORD=kibanaserver     # Custom password saved in the dashboard keystore
    WAZUH_MONITORING_ENABLED=true       # Custom settings to enable/disable wazuh-monitoring indices
    WAZUH_MONITORING_FREQUENCY=900      # Custom setting to set the frequency for wazuh-monitoring indices cron task
    WAZUH_MONITORING_SHARDS=2           # Configure wazuh-monitoring-* indices shards and replicas
    WAZUH_MONITORING_REPLICAS=0         ##

####
Directory structure

    ├── build-docker-images
    │   ├── build-images.sh
    │   ├── build-images.yml
    │   ├── README.md
    │   ├── wazuh-dashboard
    │   │   ├── config
    │   │   │   ├── config.sh
    │   │   │   ├── config.yml
    │   │   │   ├── dl_base.sh
    │   │   │   ├── entrypoint.sh
    │   │   │   ├── install_wazuh_app.sh
    │   │   │   ├── opensearch_dashboards.yml
    │   │   │   ├── wazuh_app_config.sh
    │   │   │   └── wazuh.yml
    │   │   └── Dockerfile
    │   ├── wazuh-indexer
    │   │   ├── config
    │   │   │   ├── action_groups.yml
    │   │   │   ├── config.sh
    │   │   │   ├── config.yml
    │   │   │   ├── entrypoint.sh
    │   │   │   ├── internal_users.yml
    │   │   │   ├── opensearch.yml
    │   │   │   ├── roles_mapping.yml
    │   │   │   ├── roles.yml
    │   │   │   └── securityadmin.sh
    │   │   └── Dockerfile
    │   └── wazuh-manager
    │       ├── config
    │       │   ├── check_repository.sh
    │       │   ├── create_user.py
    │       │   ├── etc
    │       │   │   ├── cont-init.d
    │       │   │   │   ├── 0-wazuh-init
    │       │   │   │   ├── 1-config-filebeat
    │       │   │   │   └── 2-manager
    │       │   │   └── services.d
    │       │   │       ├── filebeat
    │       │   │       │   ├── finish
    │       │   │       │   └── run
    │       │   │       └── ossec-logs
    │       │   │           └── run
    │       │   ├── filebeat_module.sh
    │       │   ├── filebeat.yml
    │       │   ├── permanent_data.env
    │       │   └── permanent_data.sh
    │       └── Dockerfile
    ├── CHANGELOG.md
    ├── indexer-certs-creator
    │   ├── config
    │   │   └── entrypoint.sh
    │   ├── Dockerfile
    │   └── README.md
    ├── LICENSE
    ├── multi-node
    │   ├── config
    │   │   ├── certs.yml
    │   │   ├── nginx
    │   │   │   └── nginx.conf
    │   │   ├── wazuh_cluster
    │   │   │   ├── wazuh_manager.conf
    │   │   │   └── wazuh_worker.conf
    │   │   ├── wazuh_dashboard
    │   │   │   ├── opensearch_dashboards.yml
    │   │   │   └── wazuh.yml
    │   │   └── wazuh_indexer
    │   │       ├── internal_users.yml
    │   │       ├── wazuh1.indexer.yml
    │   │       ├── wazuh2.indexer.yml
    │   │       └── wazuh3.indexer.yml
    │   ├── docker-compose.yml
    │   ├── generate-indexer-certs.yml
    │   ├── Migration-to-Wazuh-4.4.md
    │   ├── README.md
    │   └── volume-migrator.sh
    ├── README.md
    ├── SECURITY.md
    ├── single-node
    │   ├── config
    │   │   ├── certs.yml
    │   │   ├── wazuh_cluster
    │   │   │   └── wazuh_manager.conf
    │   │   ├── wazuh_dashboard
    │   │   │   ├── opensearch_dashboards.yml
    │   │   │   └── wazuh.yml
    │   │   └── wazuh_indexer
    │   │       ├── internal_users.yml
    │   │       └── wazuh.indexer.yml
    │   ├── docker-compose.yml
    │   ├── generate-indexer-certs.yml
    │   └── README.md
    └── VERSION

####
Branches

- `master` branch contains the latest code, be aware of possible bugs on this branch.
- `stable` branch on correspond to the last Wazuh stable version.

####
Compatibility Matrix

Wazuh version | ODFE | XPACK
--- | --- | ---
v4.3.0+ | N/A | N/A
v4.2.7 | 1.13.2 | 7.11.2
v4.2.6 | 1.13.2 | 7.11.2
v4.2.5 | 1.13.2 | 7.11.2
v4.2.4 | 1.13.2 | 7.11.2
v4.2.3 | 1.13.2 | 7.11.2
v4.2.2 | 1.13.2 | 7.11.2
v4.2.1 | 1.13.2 | 7.11.2
v4.2.0 | 1.13.2 | 7.10.2
v4.1.5 | 1.13.2 | 7.10.2
v4.1.4 | 1.12.0 | 7.10.2
v4.1.3 | 1.12.0 | 7.10.2
v4.1.2 | 1.12.0 | 7.10.2
v4.1.1 | 1.12.0 | 7.10.2
v4.1.0 | 1.12.0 | 7.10.2
v4.0.4 | 1.11.0 |
v4.0.3 | 1.11.0 |
v4.0.2 | 1.11.0 |
v4.0.1 | 1.11.0 |
v4.0.0 | 1.10.1 |

####
Credits and Thank you

These Docker containers are based on:

- "deviantony" dockerfiles which can be found at https://github.com/deviantony/docker-elk⁠
- "xetus-oss" dockerfiles, which can be found at https://github.com/xetus-oss/docker-ossec-server⁠

We thank you them and everyone else who has contributed to this project.

####
License and copyright

Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)

####
Web references

Wazuh website⁠

### Tag summary

Recent tags
4.14.2-rc3
Recent tags

Content type

Image

Digest

sha256:ed23fecc1…

Size

748.3 MB

Last updated

2 days ago

    docker pull wazuh/wazuh-manager:4.14.2-rc3

- System theme
- Light theme
- Dark theme

- System theme
- Light theme
- Dark theme

## Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.
More information

### Manage Consent Preferences

#### Functional Cookies

Functional Cookies

These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.

#### Strictly Necessary Cookies

Always Active

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

#### Performance Cookies

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.

#### Targeting Cookies

Targeting Cookies

These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

### Cookie List

checkbox label label
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label